CVE-2024-37497

The JetThemeCore for Elementor plugin versions through 2.2.0 contains a flaw where file path validation is inadequate, allowing authenticated users with subscriber privileges or higher to remove arbitrary files from the server. This vulnerability can be exploited to delete critical files like wp-config.php, potentially enabling attackers to achieve remote code execution.

Based on public CVE data (MITRE/NVD).